[BIG RANT ON]

We've got the Nimda virus at work http://bbs.scoobynet.co.uk/mad.gif

Got to say that it is a bloody pain in the ar$e & the whole situation is not helped by the boss http://bbs.scoobynet.co.uk/rolleyes.gif - who is also the owner.

He is of the opinion that we cannot stop the network to rid ourselves of the virus http://bbs.scoobynet.co.uk/eek.gif He would rather we suffer now less, in order to keep the network running, when to do so might potentially cripple the entire system tomorrow http://bbs.scoobynet.co.uk/eek.gif

Both I & my new staff member (who I only got 'cos I was "on holiday" last week & he needed someone to start dis-infecting) got a bollocking because we shut the network down when our Novell server jammed & we had no choice http://bbs.scoobynet.co.uk/eek.gif When I explained that we (I) 'd only done it 'cos whilst it was down we'd disinfected half the network & it was pointless to run it up again to re-infect - he went mad!

My instructions now are to try & keep the network running until it is impossible to do so any longer http://bbs.scoobynet.co.uk/rolleyes.gif This will potentially cause more chaos but he's prepared to live with that.

For my part, I'm buggered if I'm going to work out of my "hours" if all the good work that I do during the day is shafted by his attitude.

I was on the phone to Kryten (thanks for all your help m8 http://bbs.scoobynet.co.uk/biggrin.gif ) when he looked at me (on the phone...) saw my "worker" & started having a go at him - I had to put the phone down (sorry Kryten http://bbs.scoobynet.co.uk/frown.gif ) & go to his aid.

I heard the following...

"If James won't reboot the (Novell) server then I'll get you to do it & if you won't then I bloody will..."

I'm not the best sys admin the world by any means, but I'm there, I try and I (mostly) put up with his rantings. However, next time he wants to completely fcuk up someone's holiday, ring them at 1 O'clock on a Saturday morning 'cos they've had a power cut & a) he's too tight to pay for proper backup & b) none of the people he employs have a clue, and then ring again @ midnight on Saturday evening & expect me to deal with someone else (newbie staff who despite willing, needs bundles of training & knowledge) who is attempting to dis-infect the network - better find someone else http://bbs.scoobynet.co.uk/mad.gif

[/rant off]

http://bbs.scoobynet.co.uk/rolleyes.gif

Thanks to Kryten for his help & also to Jack for the AV software.

Anyone know how to completely disinfect a Novell system?? http://bbs.scoobynet.co.uk/rolleyes.gif

I sent the nai patch to the system administrators in our company for several remote sites, the command line scan..

Had a call Friday from one...asking "how do I tell if a web server has IIS running on it" http://bbs.scoobynet.co.uk/frown.gif
and another today asking "how to open a dos window" from windows. http://bbs.scoobynet.co.uk/frown.gif

And these people have been employed as engineers http://bbs.scoobynet.co.uk/frown.gif

James,

We have a company wide, mainly, Novell network with over 1000 PC's at around 20 different sites. All have been infected by our HQ with the Nimda virus. We are extremely busy at the momement but I will e-mail you with some contact numbers.

Cheers
Lee

ptmw - my sympathies; YOU ARE NOT ALONE ...getting these viruses is extremely stressful & I find it hard maintaining a calm exterior whilst the whole system is falling to bits and the users don't seem to give a fcuk.

my emotional reaction is to tell the IT guys to 'effing do something!!!'

my intellectual side has me out buying pizzas and KFC whilst the guys work thru the problem.

the plus side - nimda appears benign (just keeps replicating but not destroying) and there are now 'fixit' programs to clean up.

we logged all the pc's off, then put the fixit program into the pc's login script and then went round and turned all the pc's back on again.

as of Saturday we were clean again ....

.....until the next time.

your boss is probally technically illiterate, and has 'been on a course' so he know's a few commands like syscon http://bbs.scoobynet.co.uk/wink.gif

wouldn't worry about it too much - you tend to find the types in all places. Just make sure you run it to his specifications (all confirmed by e-mail or memo) and when the **** hits the fan, he has no comeback when ub40 comes knocking..


the only known cure for the virus? I've been using it for years.

it's called unix http://bbs.scoobynet.co.uk/wink.gif

How I love autocratic management styles! Instead of taking advice from people who specialize, just tell them what to do. He is obviously technically illiterate, possibly to the extent of being frightened of computers. These people are more annoying than those arseholey sysadmins who love the power ("I've got these priveleges and you haven't") http://bbs.scoobynet.co.uk/biggrin.gif

What you should do is e-mail him telling him that you will implement his course of action, but indicating the possible consequences. Then get him to 'buy into' it by return e-mail. Then you have an audit trail and you're covered.

Computing -- it brings out the worst in people. BTW the

I used to have this problem... send an email to all users stating that you are scheduling important downtime... after all its the users that complain... but they dont tend to complain too much if you let them know.. (make it coincide with the boss being in a meeting??)

What os are you using??

if it is nt change his boot.ini to read...

multi(0)disk(0)rdisk(0)partition(1)\WINNT="Windows NT Workstation Version 4.00" /maxmem=16

Then get him to reboot his pc... distract him whilst blue screen is on... this will mean that his pc only uses 16mb of the available memory and be very slow... then blame this on your virus... give it an hour and he wont be able to cope with 16mb of memory in nt...

Either that or disable keyboard and mouse via regedt32 over the network...

tell him he could loose vital data..

David

I think pyschotic is putting it a bit strongly, but he's nuts, he's just ordered a new MG Z-something!

Jon

Krankyd, 63,000 viruses in our collection 60,000 of which are for Microsoft OS's or Apps. Still, if we all move to another OS so will the Malcode authors.

Well - thanks for the support guys but he's not got any better http://bbs.scoobynet.co.uk/rolleyes.gif

Forgot to say yesterday that b4 I went on hols, had locked down Internet access as it was being abused. Besides that, previous instructions had been that Porn, MP3s etc & Downloads were not allowed.

Whilst crusin files to see what had been affected, came across a new file installed @ 14.15 on the 18th (day of infection) on a shareware file from Tasmania http://bbs.scoobynet.co.uk/eek.gif Brought it to his attention & he immediately starts having a go at me 'cos the file that was downloaded (by someone else but with his say-so) was unlikely to have caused the infection - maybe but how can I do my job with one hand tied behind my back when he over-rules my instructions for petty shareware http://bbs.scoobynet.co.uk/rolleyes.gif

Today - he had slept on the fact that he'd had a bit of a hard time whilst the network was incapacitate yesterday & I got a <I>further</I> bollocking for not having tried to keep it running at all costs. He even inferred that I'd done it so I'd not had a late night http://bbs.scoobynet.co.uk/eek.gif

To$$er http://bbs.scoobynet.co.uk/mad.gif

Lee

Got your email - thanks http://bbs.scoobynet.co.uk/biggrin.gif You're about 5 miles from where my Father-In-Law lives http://bbs.scoobynet.co.uk/eek.gif Next time I'm up, I'll give you a call...

philc

You are indeed an enlightened boss. No pizza/kfc for staff/me & no understanding of the situation. If I'd had a bit...

krankyd

He is indeed illiterate & can't spell nor compose even a half legible letter - serious http://bbs.scoobynet.co.uk/eek.gif He's also never been on a computer course & hasn't even the starters of an idea on syscon http://bbs.scoobynet.co.uk/rolleyes.gif

As I said before - he's part pyschotic & any email is met with a barrage of abuse & accusation http://bbs.scoobynet.co.uk/rolleyes.gif

Don't worry, I regularly forward copies of his emails to me home - just in case I need them in the future...

_

Anyway, position now is that I am to keep the network running at all costs - so until I'm satisfied that the network is stable & virus free, then it'll come back online slowly.

BTW - I've still unexplicably lost more that 1.5GB of space on 2 drives/4 volumes of our Novell server http://bbs.scoobynet.co.uk/eek.gif http://bbs.scoobynet.co.uk/confused.gif

Simple, get him via his wallet. Ask him how he feels being a security risk to your customers; what would *your* customers think of *your* company infected their system. Doesn't look good.

Can't give any technical advice as I'm an NT man - NAI's Groupshield has been doing sterling service on our File servers. Killed 27,000 instances the other day http://bbs.scoobynet.co.uk/eek.gif

Now there's that WTC.exe worm on the loose http://bbs.scoobynet.co.uk/frown.gif http://bbs.scoobynet.co.uk/frown.gif

Shuting the whole network down must be better then infecting a single customer. Sometimes bosses are the Companies worse enemy!

<BLOCKQUOTE><font size="1" face="Verdana, Arial">quote:<HR>Originally posted by JackClark:
<B>Krankyd, 63,000 viruses in our collection 60,000 of which are for Microsoft OS's or Apps. Still, if we all move to another OS so will the Malcode authors.[/quote]

Yeah, but which platform would you rather be working on? one with 60000 known viruses and nothing you can do about it 'till the beast releases you a patch, or one with 3000 viruses where you can actually make the chance yourself?

know which one I'd have http://bbs.scoobynet.co.uk/wink.gif

Hi Puff.

Thankfully I generally get left alone to run our internal LAN.

Like Miles says - infecting a customer with a customer is bad news. Probably my worst nightmare working for a reseller!

If you ever want any help, just drop me a mail or ring if you've still got my mobile number.

ChrisB.